diff --git a/bebop/identity.py b/bebop/identity.py
index 4b379ba..da88c85 100644
--- a/bebop/identity.py
+++ b/bebop/identity.py
@@ -109,6 +109,9 @@ def create_certificate(url: str, common_name: str, gen_command: list):
     except subprocess.CalledProcessError as exc:
         error = "Could not create certificate: " + str(exc)
         raise ClientCertificateException(error)
+
+    cert_path.chmod(0o644)
+    key_path.chmod(0o600)
     return mangled_name